tm-verify

Scan codebases for missing security controls and generate structured evidence reports.

8|1|Updated Jan 20, 2026

Search Tags:#codebase #compliance #evidence #grep #verify #threat-model #security-controls

Ready to run

npx skills add https://github.com/josemlopez/threat-modeling-toolkit --skill tm-verify

💬 Prompt for ChatGPT / Claude Chat▼

Please help me install this Agent Skill.
Skill: tm-verify
Source: https://github.com/josemlopez/threat-modeling-toolkit/tree/main/skills/tm-verify
Command: npx skills add https://github.com/josemlopez/threat-modeling-toolkit --skill tm-verify

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill includes references (resource) components.

What problem does it solve?

This Skill helps teams ensure that security controls documented in threat models are actually implemented in the codebase, aligning design with deployment.

Core Features & Use Cases

Control discovery: Scan repositories for evidence of authentication, authorization, input validation, and other security controls.
Evidence gathering: Collect file paths, configurations, and middleware evidence to support audits.
Remediation planning: Highlight gaps (missing or partial controls) and suggest concrete remediation steps.

Quick Start

Use the tm-verify command to check a specific control or verify all controls against the threat model. Example: /tm-verify --control rate-limiting or /tm-verify --thorough --evidence.

Frequently Asked Questions about tm-verify

High-intent search queries and answers about installing and using this skill.

FAQPage Schema

How do I verify threat model security controls are actually implemented in a codebase?▼

Verify security controls by scanning the codebase for implementation patterns using grep. The tool applies per-control patterns to identify missing or misconfigured controls and collates evidence with file paths and line references.

How can I check if authentication and authorization middleware is properly configured?▼

Check authentication and authorization middleware by applying per-control patterns to relevant code paths and configurations. The tool collects evidence and produces a structured report detailing implemented, partial, and missing controls.

What is the best way to gather compliance evidence for security audits from source code?▼

Gather compliance evidence by scanning repositories for security controls like input validation. The tool collates file paths, configurations, and middleware evidence to support audits and produce a structured report.

Can I scan for a specific security control like rate-limiting in my repository?▼

Scan for a specific security control like rate-limiting by passing the control name as an argument. The tool applies targeted patterns to relevant code paths and reports whether the control is implemented, partial, or missing.

Does this codebase security verification tool require any external dependencies?▼

No external dependencies are required to run this codebase security verification tool. It operates independently to scan repositories, apply per-control patterns, and generate structured compliance reports.

How do I identify missing security controls and plan remediation steps?▼

Identify missing security controls by scanning the codebase against threat model patterns. The tool highlights gaps in implemented, partial, and missing controls, and suggests concrete remediation steps in a structured report.